IRS_IEP_2.0_PWS_Draft.pdf

DRAFT

Contents

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 INTRODUCTION

C.1.1 BACKGROUND

C.2 OBJECTIVES

C.2.1 Contract Assumptions C.2.2 Contract Constraints

C.3 SCOPE OF WORK AND DESCRIPTION OF TASKS

C.3.1 IEP Service and Program Integration Services C.3.1.1 Program Management C.3.1.2 Service Delivery C.3.2 IEP Infrastructure Services C.3.2.1 Foundation C.3.2.2 Reliability C.3.2.3 Operation C.3.2.4 Performance C.3.3 IEP Application Hosting Services C.3.3.1 Application Hosting Support C.3.3.2 Capacity Management C.3.3.3 Incident Management C.3.3.4 Problem Management C.3.3.5 Monitoring C.3.3.6 Application Infrastructure Integration Services (AIIS) C.3.3.7 Configuration and Change Management C.3.3.8 Service Catalog C.3.3.9 Service Desk C.3.4 IEP Security Services C.3.4.1 Security Risk Management Framework C.3.4.2 Patch and Vulnerability Management C.3.4.2.1 Vulnerability Management C.3.4.2.2 Patch Management

C.3.4.2.3 Cloud Security Management C.3.4.2.4 Reporting and Visibility C.3.4.3 Plan of Action and Milestones (POA&M) C.3.4.4 Security Continuous Monitoring C.3.4.4.1 Continuous Monitoring C.3.4.4.2 Asset Management C.3.4.5 Security Configuration and Change Management C.3.4.6 Security Audit C.3.4.7 Incident Handling C.3.4.8 Business Continuity C.3.4.9 Security Control Assessment (SCA) and Contractor Security

Assessment (CSA) C.3.4.10 Defensive Cyber Operations C.3.4.11 Portal Applications Security C.3.4.12 Security Policy C.3.4.12.1 Protecting Taxpayer Data C.3.4.12.2 Access Management C.3.4.12.3 Authority to Operate (ATO) Management C.3.4.12.4 Conformance C.3.5 IEP Application Services C.3.5.1 Application Engineering Support Services C.3.5.2 Web User Analysis Data Collection C.3.5.3 Application Infrastructure Services C.3.6 IRS Cloud Workloads Integration Services C.3.7 IEP Transition Services C.3.7.1 IEP 2.0 Operational Transition C.3.7.2 Transition from IEP 2.0 Operations

C.4 PERFORMANCE REQUIREMENTS, STANDARDS AND SURVEILLANCE

C.4.1 Performance Requirements C.4.2 Performance Standards C.4.3 Surveillance

C.5 GOVERNMENT- FURNISHED PROPERTY

C.6 GOVERNMENT - FURNISHED INFORMATION

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

APPENDICES

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK

STATEMENT

C.1 INTRODUCTION

The Internal Revenue Service (IRS), Web Infrastructure Services Office (WISO), has embarked on a transformation program for its web portals referred to as the Integrated Enterprise Portals (IEP). The IRS seeks a comprehensive contract vehicle designed to enable flexibility to manage the existing services and accommodate the changing dynamics of the requirements due to Congressional mandates placed on the IRS.

The IEP is a fully scalable, managed, virtualized infrastructure capability dedicated to the IRS that provides technology services to internal and external users. The IEP plays a mission critical role in serving taxpayers, tax preparers and employees. The IEP provides fully integrated core services, including IT infrastructure, operations, security, application, integration and support, and program management services, to establish a fully integrated robust platform that supports multiple workloads, also referred to as Portals and major applications, and application styles.

(Refer to the Solicitation Section X, Attachment X.X, Current State of the IEP System and Services, for details of the existing landscape).

The Government is seeking Contractor support to provide fully managed, scalable hosting services for applications that are accessed by IRS’ external stakeholders and its internal customers. The selected Contractor will be responsible for providing all labor, hardware, software, equipment, materials, communications, facilities, and other necessary IT infrastructure to implement, deploy, operate, manage, and support the existing websites in a Federal Information Security Management Act (FISMA) moderate secure environment, as well as its underlying technology infrastructure.

C.1.1 BACKGROUND

According to the Internal Revenue Manual (IRM) Part 2.25.2, the IRS standards dictate that “…interactive and batch electronic connections are organized through as few portals as feasible and that the use of those portals is appropriate to the IRS’ mission.” The current IEP has evolved into primary gateway for external users – including taxpayers, third-party tax preparers, and other business partners – and internal users – IRS employees and contractors with staff-like access – to access IRS business services.

The current IEP vendor provides a range of application development, hosting, security, and operations services for over 90 IRS business applications. Some of the IEP-hosted application suites, such as Modernized eFile (MeF) and Integrated Customer Communications Environment (ICCE), include multiple applications that are critical to the IRS’ core mission:

delivering a successful Filing Season annually.

The IEP 1.5 vendor delivers IEP capabilities through managed services. Table 1: IEP 1.5 Contract Service Areas provides a brief overview of the IEP contract service areas.

Table 1: IEP 1.5 Contract Service Areas

IEP 1.5 Service Area Description Portal Service and Program Integration Services

Provide IEP program and contract management to ensure quality service delivery.

Portal Infrastructure Services Provide and manage a cloud-like, private, virtualized infrastructure to host the IEP environment and services.

Portal Web Hosting Services

Provide comprehensive hosting support for applications accessed by external users and organizations. Services include IEP monitoring, incident management and application infrastructure Integration.

Portal Security Services Deliver IEP Active/Edge Cyber defense and analytics.

Services include security compliance and ATO maintenance.

Portal Application Services

Provide full life-cycle engineering support for IEP-hosted applications, including operations and maintenance.

Services include IRS.gov content management hosting.

Portal Website Help Desk Services Provide the IRS.gov Help Desk for taxpayers, including IEP website questions and navigation.

Transition of Portal Operations Services Provide IEP services operations transition to other IRS designated service provider(s).

The IEP 1.5 is designed and implemented to modernize the IRS technology platform with a fully scalable, managed private cloud capability to provide a consistent, unified customer experience in a cost-effective manner. Figure 1: IEP 1.5 High-Level Architecture provides a brief illustration of the system.

Figure 1: IEP 1.5 High-Level Architecture

The IEP vendor delivers web-based services for internal and external users through multiple integrated sub-components. These components are described below.

Table 2: IEP 1.5 Components

IEP Component Description Public User Portal (PUP) • Consists primarily of the www.irs.gov website and was created to be the online presence of the IRS

• Disseminates tax news and information

• Intended to store non-Sensitive But Unclassified (SBU) information that pertains to Treasury Department Publication (TDP) 15-71 regulations

Registered User Portal (RUP) • Provides the essential security and technology components required for web access to modernized IRS business applications

• Comprised of a web-enabled, electronic commerce infrastructure that provides secure browser-based application services for tax practitioners and taxpayers

IEP Component Description Employee User Portal (EUP) • Provides IRS employees and registered users with web-enabled access to conduct tax administration transactions through both the portal and Enterprise Application Integration Broker (EAIB) systems

Transactional Portal Environment

(TPE)

• Provides the essential security and technology components required for secure structure data exchange between the IRS and the Centers for Medicare and Medicaid Services (CMMS) and other agencies external to the IRS

In addition to the components described above, the IEP vendor has been tasked to implement and support additional hosting solutions that enable the IRS mission, including establishment of common services to support Treasury Cloud integration. These services will likely continue on the contract that results from this acquisition, particularly for applications that require external user access. Figure 2: IRS Cloud Workload High-Level Architecture depicts the cloud integration.

Figure 2: IRS Cloud Workload High-Level Architecture

C.2 OBJECTIVES

The IEP vendor provides services that support the IRS core mission, annual delivery of Filing Season. Continuity of IEP services to support current and future services and technologies is key to supporting the IRS mission.

The IEP 2.0 Acquisition Project has been established to enable the following objectives:

• Ensure continuity for IEP services and provide access to IRS business systems and services and Taxpayer Transmission capabilities.

• Effectively utilize IRS workforce skills and availability to acquire, integrate, manage, and deliver IEP services.

• Provide IEP services that efficiently leverage technology over the project's life cycle and accommodate service changes driven by IRS policies and business mandates.

• All IEP services must be transitioned and fully operational no later than the end of IEP

1.5 contract period of performance.

• Enhance IRS oversight and accountability for IEP services by using efficient IT service management processes to continually improve taxpayer experience and enhance customer service.

The IRS requires vendor support to provide expertise in program and project management, technical solutions and analysis, and system integration support to integrate modernized business solutions into the IRS. The support is required in all dimensions of the IEP 2.0 Program, including developing and supporting the deployment of newly developed capabilities.

C.2.1 Contract Assumptions The below section describes the contractual assumptions.

Table 3: Contract Assumptions

Objective Type Assumption Description

Business IEP will continue to be the primary means for the IRS to provide business services to external stakeholders (e.g., taxpayers). based on current IRS policy (primary purpose of the portal is to support external interactions, not internal)

Business The portal will be required to support currently undefined/unknown future IRS business requirements and needs based upon previous historical precedence (e.g.

ACA, FATCA, ECM)

Organizational Enterprise Operations (EOps) will be the organization responsible for the oversight and management of the IEP services (run by the Director of WISO)

Organizational The solution/alternative will minimize unplanned organizational change impacts to business processes and roles/responsibilities

Technical IEP services will support cloud-based application and data hosting solutions Technical IEP services will support legacy hosting environments Technical IEP services will be able to scale up and scale down according to demand.

Technical Current/modern technology will be leveraged and inserted as it becomes available and driven by business requirements

Objective Type Assumption Description

Technical IEP services will provide users with the ability to monitor application performance in IEP environments

Operational The solution will provide an integrated view of portal services.

Operational The solution/alternative will provide additional visibility into service costs (e.g., O&M costs by application).

Operational Service levels will be optimized to meet IRS requirements Operational IEP service management processes will be able to integrate with IRS processes.

C.2.2 Contract Constraints The below section describes the constraints associated with the contract.

Objective Type Constraint Description

Organizational The ability of IRS IT organization to hire additional staff with appropriate skillsets will be limited.

Technical IEP services must comply with Government security, privacy, and regulatory requirements (e.g., FedRAMP security controls, NIST 800-53, HIPAA, NARA)

Technical IEP services must align to key IRS strategic initiatives (Modernization Plan, Technical Roadmap, etc)

C.3 SCOPE OF WORK AND DESCRIPTION OF TASKS

This Performance Work Statement (PWS) describes the scope and expectations for a Performance-Based Acquisition with mission-oriented, outcome-driven performance measures and incentives. The scope of work to be performed is envisioned to include the following distinct operational areas:

• IEP Service and Program Integration Services

• IEP Infrastructure Services

• IEP Application Hosting Services

• IEP Security Services

• IEP Application Services

• IRS Cloud Workloads Integration Services

• IEP Transition Services

C.3.1 IEP Service and Program Integration Services The objective of the IEP Service and Program Integration Services is for the vendor to provide the management necessary to deliver IEP services at the quality levels defined by the applicable service level objectives (SLOs). The requirements in this section are intended to elicit responses from the vendor regarding how it will ensure quality service delivery.

C.3.1.1 Program Management CLM ID IEP 2.0 Req ID Contents

1369972 PSPIS-FR-100 The Contractor shall document and maintain a Program Management Plan that describes management processes, organizations, and tools that will be used to ensure timely delivery of quality products and services. The Contractor shall define the Program and Project Management approach to integrate program management activities and effective service delivery across all task orders issued for IEP services.

1369974 PSPIS-FR-

The Contractor shall provide a Program Manager who will be responsible for all IEP 2.0 contract service delivery and work performance. The position of Program Manager is considered to be a Key Personnel and will be subject to the provisions of Section H.13, Key Personnel Contract Level. The Program Manager shall ensure that the Contractor satisfies all requirements.

1369975 PSPIS-FR-

The Program Manager will serve as the primary focal point for communication with the IRS IEP Program Manager, IRS Executive and Senior leadership, the Contracting Officer (CO), and the CO's Representative (COR). The Program Manager shall act as the central point of contact with the Government for all program-wide technical issues, and provide Program Management and Control to manage all IEP services performed under this contract within specified scope, quality, time, and cost objectives.

1369977 PSPIS-FR-

The Contractor shall identify subordinate functional and/or technical Project Managers to lead all IRS Integrated Enterprise Portal (IEP) key processes and ongoing project work. The position of Project Manager is considered to be Key Personnel and will be subject to the provisions of Section H.13, Key Personnel Contract Level or H.15, Key Personnel Task Order Level, as appropriate.

1369978 PSPIS-FR-

The Contractor shall participate in periodic and ad hoc meetings with the Government, as defined by the Task Orders awarded under this contract.

1369979 PSPIS-FR-

The Contractor shall support meetings with the Government, including:

agendas, meeting materials (as required), meeting minutes, and action items.

1369989 PSPIS-FR-

The Contractor shall collect and report Earned Value Management (EVM) data for work designated as Development Modernization or Enhancement (DME) in compliance with the provisions of the latest Treasury Acquisition Bulletin and the Treasury Earned Value Management Guide. EVM reporting will only by required for those projects which are within the thresholds established in the Treasury EVM Acquisition Bulletin.

1369971 PSPIS-FR-

Contractor shall: include all budget amounts in the reported EVM data, whether allocated or not, load such data into all required formats of the CPR

CLM ID IEP 2.0 Req ID Contents and ensure validity before transmitting to IRS. The calculation of EVM metrics (e.g., BCWS, BCWP and ACWP) shall comply with the guidelines and rule sets established in the Treasury EVM policy. Undistributed Budget (UB) will only be reported at the WBS level associated with the appropriate contract, task order or interagency agreement.

1369947 PSPIS-FR-

Data provided in the required CPR form and the corresponding IRS data item descriptions (DIDs), as well as the machine-readable format, must match.

1369948 PSPIS-FR-

The IRS requires CPR formats 1, 3 and 5 to be provided on a monthly basis (see Section F, Deliverables and Work Products).

1369994 PSPIS-FR-300 The Contractor shall document a staffing plan in its Program Management Plan that details how it will ensure that it can effectively staff new projects.

1369946 PSPIS-FR-

The Contractor shall deliver a Project Management Plan (PMP) to document its processes and procedures to manage and control project execution. The PMP shall include a scope statement, including project deliverables, Work Breakdown Structure (WBS), project schedule, project organization including roles and responsibilities, and the results of an initial risk assessment of the project. The PMP shall also document the Contractor's approach to performing change management and version control for contract deliverables and work products, quality management, and risk management.

1369957 PSPIS-FR-

The Contractor shall document an Operations Management Framework that clearly delineates their managed service lifecycle approach including, at a minimum, the Information Technology Infrastructure Library (ITIL) Version 3 lifecycle stages and processes shown in Appendix D, Table 3, Operations Management Framework.

1369969 PSPIS-FR-

The Contractor is required to maintain and report detailed information about project performance, schedule and cost, as well as activity progress, on a monthly basis for project control.

1369970 PSPIS-FR-

The Contractor shall prepare and submit a Contract Performance Report (CPR) each month describing the amount of work scheduled and achieved to date and the actual costs associated with that work (Format 1), baseline (Format 3), and variance analysis and explanations (Format 5). The Contractor shall prepare and submit the IRS Contract Performance Reports in accordance with the IRS CPR Data Item Description (IRS-DID-CPR) (Section J). All tasks supporting a single deliverable or work product, regardless of the owner/supplier of each task, shall be organized together and roll up to a single CWBS element and summary level task in the project schedule.

1369996 PSPIS-FR-

The Contractor shall develop a detailed project schedule that provides sufficient detail to effectively manage the project and minimize delivery risk.

1369949 PSPIS-FR-

The Contractor shall establish an overall framework for planning and executing continuous improvement for IEP. Contractor shall reserve 1% of the awarded contract value for innovation activities. The management and spending of innovation funding and its associated innovation activities shall follow IRS Innovation governance process (reference Solicitation Section J, Attachment H.1, Innovation Governance Process Overview.

1369950 PSPIS-FR-

The Contractor shall support all changes as needed by the IRS to the underlying SLO for Performance Targets around Requests, Changes and Releases on the IEP. The Contractor shall routinely report Service Level Objectives metrics.

1369951 PSPIS-FR-

In accordance with 36 CFR 1194, Subpart D, the electronic information technology (EIT) products and product support services furnished in performance of this contract shall be documented to indicate the current conformance level with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, and the Architectural and Transportation Barriers Compliance Board's Electronic and Information Technology Accessibility Standards. At no time during the performance of the award shall the level of conformance go below the level of conformance in place at the time of award.

At no additional cost, the contractor shall provide information, documentation, and support relative to the supplies and services as described in the PWS.

The contractor shall maintain this detailed listing of compliant products for the full contract term, including forms of extensions, and shall ensure that it is current within five calendar days after award and within three calendar days of changes in products being utilized as follows: (a) Product support documentation provided to end-users shall be made available in alternate formats upon request, at no additional charge. (b) End-users shall have access to a description of the accessibility and compatibility features of products in alternate formats or alternate methods upon request, at no additional charge. (c) Support services for products shall accommodate the communication needs of end- users with disabilities. (End of clause)

C.3.1.2 Service Delivery

1369981 PSPIS-FR-

The Contractor shall provide support to IEP stakeholders for IRS governance boards, as required.

1369983 PSPIS-FR-200 The Contractor shall document and maintain a Service Delivery Framework that incorporates industry best practices (e.g., ITIL).

1369984 PSPIS-FR-

The Contractor shall support and comply with enhanced IRS readiness activities (See Section J for examples).

1369985 PSPIS-FR-

During Filing Season, the Contractor shall comply with the more stringent IRS deployment control and approval processes (i.e., Production Environment Control Process).

1370005 PSPIS-FR-400 The Contractor shall provide a Communications Plan that describes its stakeholder engagement approach to ensure customer satisfaction.

1408937 PSPIS-FR-430 The Contractor shall provide an integrated service dashboard view across all service areas for near-real time visibility of critical service metrics and status conditions.

1375393 PSPIS-FR-410 The Contractor shall provide an integrated service dashboard with the capability to show service consumption information necessary to reflect service unit consumption and cost over specified time periods. The service consumption information should include granularity necessary to understand IEP hosting costs per hosted IRS application ecosystem (i.e.: at the IRS business service level).

1375394 PSPIS-FR-420 The Contractor shall perform continuous process improvement for IEP processes across all IEP services. The objective for IEP process improvements should focus on improving the service delivery quality and reflect improvements considered beneficial to the IRS.

1408933 PSPIS-FR-110 The Contractor shall comply with the IRS ELC paths for new projects, as required.

1408934 PSPIS-FR-

The Contractor shall allocate Program Management costs to a single active task order.

1408935 PSPIS-FR-

The Contractor shall empower Project Managers to coordinate with IRS stakeholders and make decisions to facilitate task delivery

1408932 PSPIS-FR-

The Contractor shall be capable of providing administration support for the operation of an IEP Technical Review Board.

1408938 PSPIS-FR-440 The Contractor shall provide an integrated service dashboard with the capability to display any operational data reporting elements specified in IEP service area requirements.

1408939 PSPIS-FR-450 The Contractor shall provide an integrated service dashboard capable of tracking service request status from service initiation through service fulfilment. Once the service is operational, the dashboard should display the critical service metrics along with actionable insights and drilldown capability to the lowest service component supporting the service delivery.

1369965 PSPIS-FR-

The ITIL Operations Management Framework shall establish a sound Operations program that maintains the integrity of the IRS Integrated Enterprise Portal Program systems and provides operational continuity for activities performed in the environment. It shall enable repeatable service management of Information Technology (IT) components as they evolve in all stages of portal development and transition, and into operations. Any updates to this framework will be provided on a semi-annual basis.

1369966 PSPIS-FR-

The Contractor shall propose an ITIL-based Service Strategy process in partnership with the IRS to seek new solutions and initiatives for business problems, and provide proactive recommendations and assessment.

1369967 PSPIS-FR-

The Contractor shall develop and maintain an Integrated Master Schedule which incorporates the Contractor, sub-contractor and IRS stakeholder detailed tasks necessary to ensure successful project execution.

1369968 PSPIS-FR-

The Contractor shall propose a methodology for program measurement in the Quality Assurance Program, including a process for developing, implementing, and monitoring a set of performance measures to ensure that program activities are effectively and efficiently supporting both business and IT strategies. This includes implementing program-wide measures, quantifiable outcomes, and providing an approach for monitoring actual-versus-expected performance.

C.3.2 IEP Infrastructure Services The objective of the IEP Infrastructure Services is for the vendor to provide the infrastructure necessary to deliver IEP services. Infrastructure includes facilities, hardware, software, middleware, network connectivity, operating system, compute resources, storage, and peripherals. The requirements in this section are intended to elicit responses from the vendor regarding how it will deliver infrastructure services to support existing and future IEP service needs.

C.3.2.1 Foundation

CLM ID IEP 2.0 Req ID Contents

1382587 PIS-FR-100 The Contractor shall document the IEP infrastructure, including the physical facilities, system architecture, components, and services necessary to establish this infrastructure; and all IRS applications' workloads hosted in this infrastructure.

1382594 PIS-FR-200 The Contractor shall design the IEP infrastructure to host all current IRS IEP applications' workloads. (Ref: Current State application details.)

1385041 PIS-FR-210 The Contractor shall design the IEP infrastructure to host new IRS applications' workloads.

1382596 PIS-FR-400 The Contractor shall design the IEP infrastructure to enable access to all IRS applications' workloads, which are hosted in this infrastructure, over secure communications network.

1385028 PIS-FR-410 The Contractor shall design the IEP infrastructure to handle changes in demands or requirements of all IRS applications' workloads hosted in this infrastructure.

1382600 PIS-FR-800 The Contractor shall design the IEP infrastructure and the IRS applications' workloads hosted in this infrastructure to allow authorized external users (users from IP addresses outside of IRS enclave) to access these IRS applications.

1385029 PIS-FR-810 The Contractor shall design the IEP infrastructure and the IRS applications' workloads hosted in this infrastructure to allow authorized internal IRS users to access these IRS applications.

1385030 PIS-FR-820 The Contractor shall design the IEP infrastructure to allow authorized IEP applications to interface with systems and application components hosted in IRS Enterprise Computing Centers (ECCs). The workloads of all such IEP applications also shall be designed to enable this interface.

1385031 PIS-FR-830 The Contractor shall design the IEP infrastructure to allow authorized IEP applications to interface with systems and application components hosted in IRS Enterprise Cloud ecosystem. The workloads of all such IEP applications also shall be designed to enable this interface.

1385026 PIS-FR-1310 The Contractor shall design the IEP infrastructure to be able to control service request rates on API Gateways and web traffic to protect them from abuse.

2457775 PIS-FR-1800 The Contractor shall avoid the use of custom solutions in the IEP infrastructure and all IRS applications' workloads hosted in this infrastructure. The Contractor shall obtain the IRS concurrence on the need to use a custom solution.

C.3.2.2 Reliability

1383166 PIS-FR-1510 The Contractor shall design the IRS application's workload to scale to meet the workload demands.

1383190 PIS-FR-1520 The Contractor shall design the IEP infrastructure to meet IRS availability and performance standards for all IRS applications’ workloads hosted in IEP infrastructure.

1383198 PIS-FR-1530 The Contractor shall design the IEP infrastructure with sufficient redundancies to support to all hosted applications' production availability requirements up to 24x7.

1383221 PIS-FR-1540 The Contractor shall design the IEP infrastructure with sufficient redundancies to support to all hosted applications' non-production availability requirements up to 24x7.

1383224 PIS-FR-1500 The Contractor shall maintain the IEP infrastructure in compliance with N/N-1 versions/standards allowable within IRS enterprise guidelines, unless exempted by IRS, and patch or replace them. (IRM 2.17.1.1, Infrastructure Currency, Infrastructure Currency Policy for Software)

1382592 PIS-FR-1400 The Contractor shall support applications owners to ensure that applications will operate in IEP infrastructure refreshes.

C.3.2.3 Operation

1385019 PIS-FR-1600 The Contractor shall evolve the IEP infrastructure to support improved operations and cost savings.

1385020 PIS-FR-1610 The Contractor shall design the IEP infrastructure to be capable of integrating with IRS enterprise systems and processes.

1385021 PIS-FR-1620 The Contractor shall design the IEP infrastructure to be capable of being decoupled from IRS enterprise systems and processes.

1385022 PIS-FR-1630 The Contractor shall design the IEP infrastructure to be capable of supporting automated provisioning.

1385023 PIS-FR-1640 The Contractor shall schedule joint exercises (e.g., game days) to test the IEP infrastructure; all IRS applications' workloads hosted in this infrastructure; the associated processes, procedures, and alarm solution; and verify that alarm solution recognizes issues correctly.

1385025 PIS-FR-1650 The Contractor shall work with IRS to establish metrics baselines for operational improvement, investigation, and intervention; collect and analyze metrics, and validate and report operations success and how the success changes over time.

C.3.2.4 Performance

2457772 PIS-FR-1700 The Contractor shall design the IEP infrastructure to enable provisioning of reliable, scalable, and secure storage to all IEP hosted IRS applications' workloads.

2457774 PIS-FR-1710 The Contractor shall design and provision network solutions to satisfy application requirements.

C.3.3 IEP Application Hosting Services The objective of the IEP Application Hosting Services is for the vendor to provide comprehensive hosting support for applications accessed by external users and organizations.

Areas covered by these requirements include IEP environment creation and maintenance, service management (e.g., incident management, service catalog), and monitoring. The requirements in this section are intended to elicit responses from the vendor regarding how it will deliver application hosting services to support existing and future IEP service needs.

C.3.3.1 Application Hosting Support

CLM ID IEP 2.0 Req ID Contents

1385707 PWHS-FR-100 The IRS is seeking to obtain IEP Application Hosting services. The Contractor shall define and document, in an Application Hosting Concept of Operations (CONOPS), its solution to provide application hosting support for development, testing, integration and production, including provisions for capacity management, incident management, performance monitoring, and infrastructure integration support.

1385709 PWHS-FR-300 The Contractor shall provision application development/testing/production environments according to the current AS-IS IEP specifications (Reference the Solicitation Section J, Attachment C.1, Current State of the IEP System and Services ) and IRS Enterprise standards, to include virtualized servers, containers, API gateways and security standards.

1385710 PWHS-FR-400 The Contractor shall support release management for each application.

Normally each application will have multiple releases and each release needs certain types of IEP application hosting environments. The Contractor shall provide lower-level (non-production) environments and production environments, as requested by each application team. IEP environments interfacing with IRS backend environments should align with the Enterprise-defined environment and security requirements. All IEP provisioned environments shall support flexible configuration options needed to support customer requirements. (Ref: IRM xxxx or EOPs SOP xxxxxx)

1369876 PWHS-FR-600 IEP non-production environments shall be capable of being configured for IRS third-party (i.e., contractors other than IEP contractor) application developers' access as needed to support external system integration testing.

1368144 PWHS-FR-700 The Contractor shall ensure all IEP non-production environments are synchronized with the corresponding IEP production environment.

1385713 PWHS-FR-

The Contractor shall demonstrate the accuracy, validity, effectiveness and maturity of the backup and restore capability, including, but not limited to, satisfying IRS authorized third party auditing needs with contractor's backup and restore parameters.

1385714 PWHS-FR-

The Contractor shall provide IEP Application Hosting Operations and Maintenance services in accordance with industry-leading practices for IT service delivery frameworks. The IT service delivery processes should align with IRS service delivery processes.

1385716 PWHS-FR-

The Contractor shall ensure IEP services satisfy availability SLOs, regardless of contractor routine maintenance activities.

C.3.3.2 Capacity Management

1385718 PWHS-FR-

The Contractor shall provide sufficient capacity to meet IRS business requirements at the applicable service levels (utilization, performance).

1385719 PWHS-FR-

The Contractor shall develop a Capacity Management Plan that details how its solution will comply with all applicable SLOs. This Capacity Management Plan will address all components necessary for IEP services (e.g.: systems processing, memory, storage, staffing and licensing for IEP).

1385723 PWHS-FR-

The Contractor shall have the ability to scale capacity to meet additional IEP service demand while still satisfying applicable SLOs (e.g., timeliness, utilization, performance).

1385724 PWHS-FR-

The Contractor shall have the ability to track and report capacity metrics for discrete components of the IEP environment (e.g., application servers, virtual machines).

1385725 PWHS-FR-

The Contractor shall develop Capacity Management plans and processes informed by industry best practices for service management (e.g., ITIL).

1385726 PWHS-FR-

The Contractor shall plan for future capacity demand changes by collecting inputs and requirements from available sources (e.g., historical demand change data and projections, stakeholder requirements).

1369918 PWHS-FR-

The Contractor shall provide a Capacity Management Plan which describes their process for capacity management to ensure that all current and future capacity and performance aspects of the IEP services are provided to meet business requirements.

1369917 PWHS-FR-

The Contractor shall provide the capability to access and view capacity information on-demand. The capacity information available should include real-time, historical, and predictive data and enable views by hosted application services.

1369916 PWHS-FR-

The Contractor shall provide the capability to generate reports on-demand.

The reports should allow analysis of real-time, historical, and predictive data and enable views by services (e.g., application).

C.3.3.3 Incident Management

1369914 PWHS-FR-

The Contractor shall establish and operate Incident Management processes that incorporate industry best practices and align with IRS policies (e.g., IRM 2.148, EOps Incident Management SOP).

1369922 PWHS-FR-

The Contractor shall develop an IEP Incident Management Standard Operating Procedure (SOP) prior to the IEP operational phase. The Contractor shall maintain and follow this SOP throughout the contract period of performance.

1385734 PWHS-FR-

The Contractor shall prioritize incidents in accordance with the IRS EOps Incident Management SOP priority criteria.

1385735 PWHS-FR-

The Contractor shall establish criteria for prioritizing incidents for all production and non-production environments.

1369919 PWHS-FR-

The Contractor shall comply with Incident Management SLOs. (Reference solicitation section J, Attachment C.10, QASP Performance)

1385736 PWHS-FR-

The Contractor shall manage all incidents related to contractor-managed IEP services. For all incidents that impact IRS, the Contractor shall service them and notify IRS in accordance with IRS Incident Management process and incident prioritization designation.

1369920 PWHS-FR-

The Contractor shall participate in the IRS Incident Management process, including ticket creation, triage, assignment, resolution, and closure.

1385738 PWHS-FR-

The Contractor shall provide the capability for the IRS to generate reports and view incident status on-demand.

1385739 PWHS-FR-

The Contractor shall use the IRS ticketing system to support IEP Incident Management processes and track progress towards resolution.

1385740 PWHS-FR-

The Contractor shall comply with the EOps Incident Management SOP and applicable IRM sections regarding entry and tracking of incidents in the IRS system.

1369923 PWHS-FR-

The Contractor shall provide the capability for the IRS to view and verify compliance with incident management SLOs on demand.

C.3.3.4 Problem Management

1269453 PWHS-FR-

The Contractor shall develop an IEP Problem Management Standard Operating Procedure (SOP) prior to the IEP operational phase. The Contractor shall maintain and follow this SOP throughout the contract period of performance.

1369911 PWHS-FR-

The Contractor's Problem Management process shall comply with the IRS EOps Problem Management SOP and applicable IRM sections.

1369912 PWHS-FR-

The Contractor shall use the IRS ticketing system to record problems and track progress towards resolution.

C.3.3.5 Monitoring

1269452 PWHS-FR-

The Contractor shall provide monitoring services to enable the successful delivery of IEP services.

1272856 PWHS-FR-

The Contractor shall document its monitoring processes in a Monitoring and Management Plan. This plan should demonstrate how the Contractor's processes, tools, and staffing enable the IRS to have an integrated, timely view into the health of IEP services.

1272857 PWHS-FR-

The Contractor shall provide end-to-end monitoring of IEP services.

2461811 PWHS-FR-

The Contractor shall provide monitoring data in a format that can be used by IRS systems and processes.

1272858 PWHS-FR-

The Contractor shall provide IRS users the capability to view monitoring data on demand.

1272865 PWHS-FR-

The Contractor shall be capable of supporting the existing IEP applications' built-in monitoring capabilities or equivalent monitoring capabilities available using the IEP monitoring tools.

1272864 PWHS-FR-

The Contractor shall provide periodic monitoring reports regarding the health and status of IEP services.

1272900 PWHS-FR-

The Contractor shall provide the capability for IRS users to access monitoring data and reports on demand.

1272862 PWHS-FR-

The Contractor shall provide the capability to collect, store, archive, and retrieve log files and monitoring event data.

1272861 PWHS-FR-

The Contractor shall support IRS-authorized audits, including information requests from third parties.

1272901 PWHS-FR-

The Contractor shall comply with IRS data storage and retention policies. See IRS IRM Section 1.15, Records and Information Management.

1272902 PWHS-FR-

The Contractor shall identify and resolve system problems using Application Discovery, Tracing and Diagnostic (ADTD) capabilities.

1272903 PWHS-FR-

The Contractor shall use Artificial Intelligence for IT Operations (AIOps) capabilities to automate routine manual processes while continuously improving the ability to autonomously identify and determine root causes.

1272904 PWHS-FR-

The Contractor shall provide the capability to use Container Monitoring and Control to monitor and collect metrics to ensure applications running in containers are performing properly.

1272905 PWHS-FR-

The Contractor shall provide the capability to use Microservice Monitoring and Logging Control to prevent, predict, and detect microservice anomalies and issues.

1272906 PWHS-FR-

The Contractor shall monitor and control the end-user interaction experience with the system/application using digital experience monitoring and control capabilities.

2461835 PWHS-FR-

The Contractor shall provide monitoring and control reporting, dashboards, alerts capable of providing summary/detailed information, configured to run per schedule/ad-hoc using context-drive data.

C.3.3.6 Application Infrastructure Integration Services (AIIS)

1369924 PWHS-FR-

The Contractor shall provide Application Infrastructure Integration Services (AIIS) to ensure applications are correctly configured in the IEP hosting environments. The Contractor is responsible for receiving application packages from IRS application teams and providing integration with IEP environments throughout application integration, testing and production deployment phases in compliance with the Contractor's change management and deployment processes.

1369862 PWHS-FR-

The Contractor shall provide AIIS support, to include:

a. Application deployment

b. Analysis of IT infrastructure requirements from applications

c. Configuration and troubleshooting support

d. Shared Services support.

1369863 PWHS-FR-

The Contractor shall provide AIIS support to application owners throughout application life-cycle. The Contractor shall provide AIIS support to all IEP-hosted applications, including new ones not included in the original IEP application baseline.

1369864 PWHS-FR-

The Contractor shall provide knowledge transfer support for application technical reviews.

1369866 PWHS-FR-

The Contractor shall integrate AIIS with other contractor-provided IEP services, including Release Management, Performance Monitoring, Incident Management, and Problem Management.

1369867 PWHS-FR-

The Contractor shall troubleshoot and debug AIIS issues associated with IEP services, Shared Service components, and any third-party service providers.

1369868 PWHS-FR-

The Contractor shall help application owners to identify the integration points that could be causing an issue with application operations. The Contractor shall coordinate ticket resolution in accordance with the incident management process.

1369875 PWHS-FR-

The Contractor shall support multiple, concurrent, release work streams for each IEP-hosted application. The IRS expects this capability to support automated, industry-standard application release practices for IEP-hosted applications.

PWHS-FR-

The Contractor shall support the ability to deploy application changes using modern deployment methods to maximize high application availability (e.g.: blue-green and canary deployments).

1369877 PWHS-FR-

The Contractor shall support application deployment into the IEP environments, including containers, and assist the application owners troubleshooting applications before, during, and after application deployment.

1369879 PWHS-FR-

The Contractor shall support application owners test activities. Test activities support includes all testing requirements e.g., functional, integration, Alternative Processing Site (APS) testing, load testing, ad hoc testing and performance testing. (Ref: APS standards (IRM 10.8.60)

1369880 PWHS-FR-

The Contractor shall provide a fully integrated, turn-key solution for application deployment and integration. The Contractor shall operate and integrate all solutions proposed and implemented by the Contractor.

1369881 PWHS-FR-

The Contractor shall develop and maintain a Guide for Application Developers. The guide will provide guidance, processes and procedures for application developers to rapidly deploy, test, and integrate existing and new applications to the IEP environments without degrading IEP service performance. The Contractor shall enforce application deployment compliance with this guide.

1369882 PWHS-FR-

The Contractor shall provide engineering services to support investigation of IRS IT strategies for taxpayer services. These services shall support initiative research, analysis, and engineering exploration, e.g.: IRS research/analysis/engineering, problems diagnoses, solution/investigation alternatives proposals.

1385807 PWHS-FR-

The Contractor shall be capable of supporting cloud migration and modernization of IEP-hosted applications.

C.3.3.7 Configuration and Change Management

1368140 PWHS-FR-

The Contractor shall publish a Configuration and Change Management Plan, based on industry-standard service management practices. The Change Management processes will comply with the IRS Change Management processes. (Reference IRM 2.150)

1368141 PWHS-FR-

Specifically, the Contractor shall track configuration items that impact IEP hosted application configurations, service configuration attributes, and hosting environment attributes.

1369713 PWHS-FR-

The Contractor shall periodically report configuration details for all applications hosted in IEP provisioned environments to include hosting environment attributes and active/inactive usage status.

1368143 PWHS-FR-

The Contractor shall integrate the IEP Configuration Management processes and comply with the IRS Configuration Management process. (Ref: IRM 2.150, Configuration and Change Management)

1368146 PWHS-FR-

The Contractor shall minimize the impact of change-related incidents upon service quality.

1368149 PWHS-FR-

The Contractor shall publish a Change Management Standard Operation Procedure (SOP) that includes: the change management process itself, the change management system, roles and responsibilities of the stakeholders, and the integration points with the IRS Change Management process.

1368152 PWHS-FR-

The Contractor shall publish a Deployment Management Standard Operating Procedure (SOP) that describes the processes and procedures to coordinate application deployments. The Deployment processes should include re-deployment of the previous application version, if required, subject to the same deployment SLO performance level.

1368153 PWHS-FR-

The Contractor shall provide the processes and tools to support automated deployments that comply with IRS application deployment standards, including the IRS CI/CD process. Automated deployments shall support the current IEP

Control Document (IEP-CD) interface (Refer to Solicitation Section J, Attachment C.2, IRS Enterprise Portal Control Document) and shall include automated deployment status notifications to application stakeholders.

1368154 PWHS-FR-

The Contractor shall manage all deployments to all environments. The Contractor shall support customer requests to use their own deployment process for non-production environments and include this option as one of the standard offerings in the Service Catalog.

1368158 PWHS-FR-

The Contractor shall provide application owners with a repeatable deployment process to include:

a. Assistance creating deployment packages

b. Resource and tools for pre-deployment, including validating deployment packages.

1369686 PWHS-FR-

The Contractor shall provide an IEP Enterprise Integration Test Environment (EITE) that matches the production environment for all applications.

1368159 PWHS-FR-

After IEP service changes or application deployments, the Contractor shall provide confidence testing for each application and resolve all the deployment issues. Confidence testing will include:

i. Validation that the main application Uniform Resource Locator (URLs) are accessible

ii. Validation, using test accounts, that basic login functionality is operational

iii. Review of deployment related logs to ensure there are no anomalies

iv. Connectivity validation

1368160 PWHS-FR-

The Contractor shall maintain maintenance and patch management licenses for all Contractor-managed components within the IEP environments, including: services, hardware, software, and networking.

1368161 PWHS-FR-

The Contractor shall establish a patch management process and plan in accordance with the IRM 10.8.50, Servicewide Security Patch Management and IEP Security Service requirements.

1368162 PWHS-FR-

The Contractor shall automate the patch management process for IEP.

C.3.3.8 Service Catalog

1369728 PWHS-FR-

The Contractor shall provide a Service Catalog that includes a listing of standard services available to IEP customers. The Contractor shall manage the Service Catalog in accordance with industry-leading practices.

1369735 PWHS-FR-

The Contractor proposed set of standardized service offerings shall include:

1. Infrastructure-as-a-Service (IaaS) provisioning and management

2. Platform-as-a-Service (PaaS) provisioning and management

3. Software-as-a-Service (SaaS) for Managed Service Provider (MSP) managed application engineering and operations

4. Application Infrastructure Integration Services

5. Deploy Application Service

6. Application Performance-Tuning Services

7. IEP Reports and Data Analytics information in response to ad hoc service requests

8. Ad hoc Reports

9. Non-standard Service Request

1369736 PWHS-FR-

The service catalog function shall include an automated, streamlined process to capture customer requirements for standard IEP services. Additionally, the service catalog capability should support service cost estimates, service tailoring and approval for non-standard service requests.

1369738 PWHS-FR-

The Contractor shall train all IEP stakeholders on the IEP Service Catalog.

The training should be tailored to stakeholder role (e.g., IEP Program staff, IEP Customers). Remote training sessions shall accommodate at least a minimum of 50 attendees per session. Training frequency for initial service catalog training should provide at least two sessions per month prior to transition to IEP 2.0 service catalog operations. After the initial formal training, additional training sessions can be requested as needed by IEP service catalog users groups.

1369745 PWHS-FR-

The Contractor shall establish an IEP On-Boarding process to manage requests for…